Solved

Spanning tree Portfast Bpdugard

Posted on 2016-07-17
15
74 Views
Last Modified: 2016-07-22
I am trying to see the difference in configuring Bpdugard Globally and on specific interfaces
- when  configured On specific Interfaces when it receives superior BPDU the interface will go to err-disable status
-when configured Globally, I do not see any difference, I mean NO  ports go to err-disable status.

Any clarification on BPDGUARD when configured globally ?

Thank you
0
Comment
Question by:jskfan
  • 9
  • 2
  • 2
  • +2
15 Comments
 
LVL 9

Assisted Solution

by:Richardson Porto
Richardson Porto earned 33 total points
ID: 41716075
You can enable or disable STP PortFast BPDU guard on a global basis, which affects all ports that have PortFast configured.

Source: http://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/10586-65.html#topic3
0
 
LVL 50

Assisted Solution

by:Don Johnston
Don Johnston earned 33 total points
ID: 41716107
The global BPDUguard and BPDUfilter command only apply to ports which are configured with portfast.
0
 

Author Comment

by:jskfan
ID: 41716197
I did configure on Switch 1 globally spanning tree portfast default  and spanning portfast Bpdugard default

on SW2 I shut down the connected interfaces to Switch 1,   then brought them back up with No Shutdown.
However nothing happen on Switch1. I mean I do not see the ERR-DISABLE  keyword.

Per Port configuration:
I  configured the same thing on Interfaces I get the ERR_DIsable when Switch2 interfaces come back up, but Globally I have not seen that happened.
0
 
LVL 50

Expert Comment

by:Don Johnston
ID: 41716215
First... Are these real switches or packet tracer or GNS?

If they aren't actual, physical switches, we're done. The simulators and emulators have too many inconsistencies.

Second, if we're talking about actual switches, please post the configs and specify which ports are relevant.
0
 
LVL 9

Expert Comment

by:Ian Arakel
ID: 41717020
Hi there,

There is no difference in functionality of BPDU guard when configured globally or per interface basis.
The transitioning of the port into err-disabled once a BPDU is received on the BPDU guard enabled is the same in both cases.
0
 
LVL 26

Assisted Solution

by:Predrag Jovic
Predrag Jovic earned 34 total points
ID: 41717585
Note:
- when  configured On specific Interfaces when it receives superior BPDU the interface will go to err-disable status
This is not function of BPDUguard.
BPDU guard puts port into err-disabled state as soon as it receives any BDPU on interface.
Root Guard is the one that matches that description - when superior BDPU is received will place port in root-inconsistent state.
0
 

Author Comment

by:jskfan
ID: 41718058
SW1#sh run
Building configuration...

Current configuration : 1129 bytes
!
! Last configuration change at 01:46:10 CET Tue Jul 19 2016
!
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
service compress-config
!
hostname SW1
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
clock timezone CET 1 0
no ipv6 cef
ipv6 multicast rpf use-bgp
!
ip cef
!
!
!
!
!
spanning-tree mode rapid-pvst
spanning-tree portfast default
spanning-tree portfast bpduguard default
spanning-tree extend system-id
!
!
!
!
vlan internal allocation policy ascending
!
!
!
!
!
!
!
!
!
!
interface Ethernet0/0
 duplex auto
!
interface Ethernet0/1
 duplex auto
!
interface Ethernet0/2
 duplex auto
!
interface Ethernet0/3
 duplex auto
!
interface Ethernet1/0
 duplex auto
!
interface Ethernet1/1
 duplex auto
!
interface Ethernet1/2
 duplex auto
!
interface Ethernet1/3
 duplex auto
!
interface Ethernet2/0
 duplex auto
!
interface Ethernet2/1
 duplex auto
!
interface Ethernet2/2
 duplex auto
!
interface Ethernet2/3
 duplex auto
!
!
no ip http server
!
!
!
!
!
control-plane
!
!
line con 0
 logging synchronous
line aux 0
line vty 0 4
 login
!
end

Open in new window



SW2#sh run
Building configuration...

Current configuration : 1117 bytes
!
! Last configuration change at 01:43:05 CET Tue Jul 19 2016
!
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
service compress-config
!
hostname SW2
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
clock timezone CET 1 0
no ipv6 cef
ipv6 multicast rpf use-bgp
!
ip cef
!
!
!
!
!
spanning-tree mode rapid-pvst
spanning-tree extend system-id
!
!
!
!
vlan internal allocation policy ascending
!
!
!
!
!
!
!
!
!
!
interface Ethernet0/0
 duplex auto
!
interface Ethernet0/1
 shutdown
 duplex auto
!
interface Ethernet0/2
 shutdown
 duplex auto
!
interface Ethernet0/3
 shutdown
 duplex auto
!
interface Ethernet1/0
 duplex auto
!
interface Ethernet1/1
 duplex auto
!
interface Ethernet1/2
 duplex auto
!
interface Ethernet1/3
 duplex auto
!
interface Ethernet2/0
 shutdown
 duplex auto
!
interface Ethernet2/1
 shutdown
 duplex auto
!
interface Ethernet2/2
 duplex auto
!
interface Ethernet2/3
 shutdown
 duplex auto
!
!
no ip http server
!
!
!
!
!
control-plane
!
!
line con 0
 logging synchronous
line aux 0
line vty 0 4
 login
!
end

Open in new window

STP.JPG
0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 

Author Comment

by:jskfan
ID: 41718060
As shown in the attached file, on SW2 I shut down e0/0 and e2/2 then brings them back up
the e2/2 on SW1 will go through LIST/LRN/FWD
but does not go to Err-Disable state
0
 

Author Comment

by:jskfan
ID: 41718061
stp
0
 

Author Comment

by:jskfan
ID: 41718068
SW1#sh span

VLAN0001
  Spanning tree enabled protocol rstp
  Root ID    Priority    32769
             Address     aabb.cc00.0100
             This bridge is the root
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32769  (priority 32768 sys-id-ext 1)
             Address     aabb.cc00.0100
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Et0/0               Desg FWD 100       128.1    Shr
Et0/1               Desg FWD 100       128.2    Shr Edge
Et0/2               Desg FWD 100       128.3    Shr Edge
Et0/3               Desg FWD 100       128.4    Shr Edge
Et1/0               Desg FWD 100       128.5    Shr Edge
Et1/1               Desg FWD 100       128.6    Shr Edge
Et1/2               Desg FWD 100       128.7    Shr Edge
Et1/3               Desg FWD 100       128.8    Shr Edge

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------

Et2/0               Desg FWD 100       128.9    Shr Edge
Et2/1               Desg FWD 100       128.10   Shr Edge
Et2/2               Desg FWD 100       128.11   Shr
Et2/3               Desg FWD 100       128.12   Shr Edge

Open in new window


SW1#sh interfaces statu

Port      Name               Status       Vlan       Duplex  Speed Type
Et0/0                        connected    trunk        auto   auto unknown
Et0/1                        connected    1            auto   auto unknown
Et0/2                        connected    1            auto   auto unknown
Et0/3                        connected    1            auto   auto unknown
Et1/0                        connected    1            auto   auto unknown
Et1/1                        connected    1            auto   auto unknown
Et1/2                        connected    1            auto   auto unknown
Et1/3                        connected    1            auto   auto unknown
Et2/0                        connected    1            auto   auto unknown
Et2/1                        connected    1            auto   auto unknown
Et2/2                        connected    trunk        auto   auto unknown
Et2/3                        connected    1            auto   auto unknown
SW1#

Open in new window

0
 
LVL 9

Accepted Solution

by:
Ian Arakel earned 400 total points
ID: 41718156
Hi there,

This behavior is observed since you have not configured the e2/2 and e0/0 as access ports.
The ports assume a trunk role by default as per my understanding

Below is fact as per the Cisco documentation:

PortFast BPDU guard prevents loops by moving a nontrunking port into an errdisable state when a BPDU is received on that port. When you enable BPDU guard on the switch, spanning tree shuts down PortFast-configured interfaces that receive BPDUs instead of putting them into the spanning tree blocking state
0
 

Author Comment

by:jskfan
ID: 41719071
This behavior is observed since you have not configured the e2/2 and e0/0 as access ports.
The ports assume a trunk role by default as per my understanding

I thought about that last night after I watched youtube video.
I will try it later
0
 

Author Comment

by:jskfan
ID: 41719072
Thank you
0
 

Author Comment

by:jskfan
ID: 41719075
However when I configured BPDUGUARD by Port instead Gloabal...even the ports were Trunk...one of them still went to Err-Disable status
0
 

Author Comment

by:jskfan
ID: 41720064
These are the Findings:
BPDUGUARD (GLOBAL)

LAB example:
on SW2= Shutdown the Port Connecting to SW1

On SW1:
First the Port(s)  facing the Devices that are not supposed to Send BPDUs ; such as computers need to be configured as Access Ports.
Then at the global configuration of the Switch facing the computers, configure with both commands below:

SW1(config)#spanning-tree portfast default
SW1(config)#spanning-tree portfast bpduguard default

on SW2= Type No Shutdown on the Port Connecting to SW1, This will send BPDUs to the access port on SW1 and the port will go into Err-Disable State.
===================================

Per Port

I did not have to configure any port linking SW1 to SW2 as access port , I left them as Trunk
Lab Example
ON SW2: I shutdown the trunk port linking to SW1
On SW1 :
SW1(config-if)#spanning-tree bpduguard enable

Then on SW2, I type No Shutdown on the Trunk port
SW1 port went into err-disable state.
0

Featured Post

Control application downtime with dependency maps

Visualize the interdependencies between application components better with Applications Manager's automated application discovery and dependency mapping feature. Resolve performance issues faster by quickly isolating problematic components.

Join & Write a Comment

Suggested Solutions

I eventually solved a perplexing problem setting up telnet for a new switch.  I installed a new Cisco WS-03560X-24P switch connected to an existing Cisco 4506 running a WS-X4013-10GE Sup II-Plus. After configuring vlans and trunking,  I could no…
We recently endured a series of broadcast storms that caused our ISP to shut us down for brief periods of time. After going through a multitude of tests, we determined that the issue was related to Intel NIC drivers on some new HP desktop computers …
Viewers will learn how to properly install and use Secure Shell (SSH) to work on projects or homework remotely. Download Secure Shell: Follow basic installation instructions: Open Secure Shell and use "Quick Connect" to enter credentials includi…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now